@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/src/modules/customers/api/companies/[id]/route.ts

@@ -17,6 +17,8 @@ import {
   CustomerDealCompanyLink,
   CustomerDeal,
   CustomerTodoLink,
+  CustomerPersonCompanyLink,
+  CustomerPersonProfile,
   CustomerInteraction,
 } from '../../../data/entities'
 import { User } from '@open-mercato/core/modules/auth/data/entities'
@@ -45,12 +47,11 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { parseBooleanFromUnknown } from '@open-mercato/shared/lib/boolean'
 import {
-  countCompanyPeopleUnion,
-  loadCompanyPeopleUnion,
-  type CompanyPersonUnionEntry,
-} from '../../../lib/personCompanies'
+  filterActivePersonCompanyLinks,
+  withActiveCustomerPersonCompanyLinkFilter,
+} from '../../../lib/personCompanyLinkTable'
 import { normalizeCustomerDetailCustomFields } from '../../detailCustomFields'
-import { denyCustomerDetailReadAsNotFound } from '../../../lib/detailReadAccess'
+import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import {
   buildCollectionTags,
@@ -145,6 +146,10 @@ function parseIncludeParams(request: Request): Set<string> {
   return tokens
 }
 
+function forbidden(message: string) {
+  return NextResponse.json({ error: message }, { status: 403 })
+}
+
 function notFound(message: string) {
   return NextResponse.json({ error: message }, { status: 404 })
 }
@@ -458,16 +463,9 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
   )
   if (!company) return notFound('Company not found')
 
-  // Existence oracle (issue #5504): a caller who holds customers.companies.view
-  // but whose scope excludes the record's organization must get the SAME
-  // response as for a non-existent id, so 403-when-present / 404-when-absent
-  // collapses to a uniform 404 not-found. The dispatcher already returns a
-  // uniform 403 for callers who lack the feature entirely.
-  const organizationReadDenied = denyCustomerDetailReadAsNotFound(
-    { scope, auth, organizationId: company.organizationId },
-    'Company not found',
-  )
-  if (organizationReadDenied) return organizationReadDenied
+  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: company.organizationId })) {
+    return forbidden('Access denied')
+  }
 
   const companyScope = {
     tenantId: company.tenantId ?? auth.tenantId ?? null,
@@ -803,13 +801,79 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
             deal.organizationId === company.organizationId,
         )
 
-  const peopleUnionScope = {
-    tenantId: company.tenantId ?? auth.tenantId ?? null,
-    organizationId: company.organizationId ?? scope?.selectedId ?? auth.orgId ?? null,
-  }
-  let relatedPeople: CompanyPersonUnionEntry[] = []
+  let relatedPeople: Array<{
+    entity: CustomerEntity
+    profile: CustomerPersonProfile | null
+    linkedAt: string | null
+  }> = []
   if (includePeople) {
-    relatedPeople = await loadCompanyPeopleUnion(em, company, peopleUnionScope)
+    const peopleDecryptionScope = {
+      tenantId: company.tenantId ?? auth.tenantId ?? null,
+      organizationId: company.organizationId ?? scope?.selectedId ?? auth.orgId ?? null,
+    }
+    const relatedPeopleById = new Map<
+      string,
+      { entity: CustomerEntity; profile: CustomerPersonProfile | null; linkedAt: string | null }
+    >()
+    const companyLinkWhere = await withActiveCustomerPersonCompanyLinkFilter(
+      em,
+      {
+        company: company.id,
+        organizationId: company.organizationId,
+        tenantId: company.tenantId,
+      },
+      'customers.companies.GET',
+    )
+    const companyLinks = filterActivePersonCompanyLinks(
+      await findWithDecryption(
+        em,
+        CustomerPersonCompanyLink,
+        companyLinkWhere,
+        {
+          populate: ['person', 'person.personProfile'],
+          orderBy: { isPrimary: 'desc', createdAt: 'asc' },
+        },
+        peopleDecryptionScope,
+      ),
+    )
+    companyLinks.forEach((link) => {
+      const entity = typeof link.person === 'string' ? null : link.person
+      if (!entity || entity.kind !== 'person' || entity.deletedAt) return
+      const personProfile =
+        entity.personProfile && typeof entity.personProfile !== 'string'
+          ? entity.personProfile
+          : null
+      relatedPeopleById.set(entity.id, {
+        entity,
+        profile: personProfile,
+        linkedAt: link.createdAt instanceof Date ? link.createdAt.toISOString() : null,
+      })
+    })
+
+    const profiles = await findWithDecryption(
+      em,
+      CustomerPersonProfile,
+      {
+        company: company.id,
+        tenantId: company.tenantId,
+        organizationId: company.organizationId,
+        entity: { deletedAt: null },
+      },
+      { populate: ['entity'] },
+      peopleDecryptionScope,
+    )
+    profiles.forEach((entry) => {
+      const entity = entry.entity as CustomerEntity | null
+      if (!entity || entity.kind !== 'person' || entity.deletedAt) return
+      if (!relatedPeopleById.has(entity.id)) {
+        relatedPeopleById.set(entity.id, {
+          entity,
+          profile: entry ?? null,
+          linkedAt: entry.createdAt instanceof Date ? entry.createdAt.toISOString() : null,
+        })
+      }
+    })
+    relatedPeople = Array.from(relatedPeopleById.values())
   }
 
   // Entity custom fields, profile custom fields, and the routing lookup do not
@@ -855,7 +919,26 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
   // instead of a waterfall (issue #3203).
   const peopleCountQuery = includePeople
     ? Promise.resolve(relatedPeople.length)
-    : countCompanyPeopleUnion(em, company)
+    : (async () => {
+        const peopleLinkWhere = await withActiveCustomerPersonCompanyLinkFilter(
+          em,
+          {
+            company: company.id,
+            organizationId: company.organizationId,
+            tenantId: company.tenantId,
+          },
+          'customers.companies.GET',
+        )
+        return filterActivePersonCompanyLinks(
+          await findWithDecryption(
+            em,
+            CustomerPersonCompanyLink,
+            peopleLinkWhere,
+            {},
+            { tenantId: company.tenantId, organizationId: company.organizationId },
+          ),
+        ).length
+      })()
   const [
     activityCount,
     interactionCount,
@@ -1403,8 +1486,8 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid identifier', schema: companyDetailErrorSchema },
         { status: 401, description: 'Unauthorized', schema: companyDetailErrorSchema },
-        { status: 403, description: 'Forbidden — caller lacks the required feature', schema: companyDetailErrorSchema },
-        { status: 404, description: 'Company not found, or its organization is not in the caller’s scope', schema: companyDetailErrorSchema },
+        { status: 403, description: 'Forbidden for tenant/organization scope', schema: companyDetailErrorSchema },
+        { status: 404, description: 'Company not found', schema: companyDetailErrorSchema },
       ],
     },
   },

package/src/modules/customers/api/dashboard/widgets/customer-todos/route.ts

@@ -28,10 +28,7 @@ export const metadata = {
 
 type WidgetContext = WidgetScopeContext & { limit: number }
 
-async function resolveContext(
-  req: Request,
-  translate: (key: string, fallback?: string) => string,
-): Promise<WidgetContext> {
+async function resolveContext(req: Request, translate: (key: string, fallback?: string) => string): Promise<WidgetContext> {
   const url = new URL(req.url)
   const rawQuery: Record<string, string> = {}
   for (const [key, value] of url.searchParams.entries()) {
@@ -42,18 +39,16 @@ async function resolveContext(
     throw new CrudHttpError(400, { error: translate('customers.errors.invalid_query', 'Invalid query parameters') })
   }
 
-  const { container, em, tenantId, organizationIds, isUnrestrictedOrganizationScope } =
-    await resolveWidgetScope(req, translate, {
-      tenantId: parsed.data.tenantId ?? null,
-      organizationId: parsed.data.organizationId ?? null,
-    })
+  const { container, em, tenantId, organizationIds } = await resolveWidgetScope(req, translate, {
+    tenantId: parsed.data.tenantId ?? null,
+    organizationId: parsed.data.organizationId ?? null,
+  })
 
   return {
     container,
     em,
     tenantId,
     organizationIds,
-    isUnrestrictedOrganizationScope,
     limit: parsed.data.limit,
   }
 }
@@ -61,8 +56,7 @@ async function resolveContext(
 export async function GET(req: Request) {
   const { translate } = await resolveTranslations()
   try {
-    const { container, em, tenantId, organizationIds, isUnrestrictedOrganizationScope, limit } =
-      await resolveContext(req, translate)
+    const { container, em, tenantId, organizationIds, limit } = await resolveContext(req, translate)
     const auth = {
       tenantId,
       orgId: organizationIds?.[0] ?? null,
@@ -70,7 +64,6 @@ export async function GET(req: Request) {
     }
     const flags = await resolveCustomerInteractionFeatureFlags(container, tenantId)
     const mergedWindow = Math.min(limit * 4, 50)
-    const isUnrestricted = isUnrestrictedOrganizationScope === true
     const rows = flags.unified
       ? (await listCanonicalTodoRows(
           em,
@@ -78,7 +71,7 @@ export async function GET(req: Request) {
           auth,
           organizationIds?.[0] ?? null,
           organizationIds ?? null,
-          { pagination: { page: 1, pageSize: limit }, isUnrestricted },
+          { pagination: { page: 1, pageSize: limit } },
         )).items
       : await Promise.all([
           listLegacyTodoRows(
@@ -87,7 +80,7 @@ export async function GET(req: Request) {
             tenantId,
             organizationIds ?? null,
             undefined,
-            { limit: mergedWindow, isUnrestricted },
+            { limit: mergedWindow },
           ),
           listCanonicalTodoRows(
             em,
@@ -98,7 +91,6 @@ export async function GET(req: Request) {
             {
               includeDeleted: true,
               limit: mergedWindow,
-              isUnrestricted,
             },
           ),
         ]).then(([legacyRows, canonicalRows]) =>

package/src/modules/customers/api/deals/[id]/companies/route.ts

@@ -101,11 +101,8 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
       throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
     }
 
-    // Existence oracle (#5504): deny a cross-org read as not-found — identical to
-    // the parent-not-found above — so it cannot reveal that a deal exists in an
-    // organization the caller cannot see.
     if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {
-      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
+      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
     }
 
     const entityScope = { tenantId: deal.tenantId, organizationId: deal.organizationId }

package/src/modules/customers/api/deals/[id]/people/route.ts

@@ -102,11 +102,8 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
       throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
     }
 
-    // Existence oracle (#5504): deny a cross-org read as not-found — identical to
-    // the parent-not-found above — so it cannot reveal that a deal exists in an
-    // organization the caller cannot see.
     if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {
-      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
+      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
     }
 
     const entityScope = { tenantId: deal.tenantId, organizationId: deal.organizationId }

package/src/modules/customers/api/deals/[id]/route.ts

@@ -19,9 +19,10 @@ import type { ActionLogService } from '@open-mercato/core/modules/audit_logs/ser
 import { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'
 import { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fields/normalize'
 import { E } from '#generated/entities.ids.generated'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { denyCustomerDetailReadAsNotFound } from '../../../lib/detailReadAccess'
+import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
 import { decryptEntitiesWithFallbackScope } from '@open-mercato/shared/lib/encryption/subscriber'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import {
@@ -46,6 +47,10 @@ function notFound(message: string) {
   return NextResponse.json({ error: message }, { status: 404 })
 }
 
+function forbidden(message: string) {
+  return NextResponse.json({ error: message }, { status: 403 })
+}
+
 type DealAssociation = {
   id: string
   label: string
@@ -411,10 +416,23 @@ export async function GET(request: Request, context: { params?: Record<string, u
     return NextResponse.json({ error: 'Authentication required' }, { status: 401 })
   }
 
-  // The API dispatcher already enforces `requireFeatures: ['customers.deals.view']`
-  // against the caller's effective (selected) organization before this handler
-  // runs, so no in-route feature re-check is needed. Re-checking here against the
-  // token org (auth.orgId) would wrongly 403 org-switched callers (#5012).
+  let rbac: RbacService | null = null
+  try {
+    rbac = (container.resolve('rbacService') as RbacService)
+  } catch {
+    rbac = null
+  }
+
+  if (!rbac || !auth?.sub) {
+    return forbidden('Access denied')
+  }
+  const hasFeature = await rbac.userHasAllFeatures(auth.sub, ['customers.deals.view'], {
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+  })
+  if (!hasFeature) {
+    return forbidden('Access denied')
+  }
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
   const em = (container.resolve('em') as EntityManager)
@@ -436,16 +454,9 @@ export async function GET(request: Request, context: { params?: Record<string, u
     return notFound('Deal not found')
   }
 
-  // Existence oracle (issue #5504): a caller who holds customers.deals.view but
-  // whose scope excludes the record's organization must get the SAME response as
-  // for a non-existent id, so 403-when-present / 404-when-absent collapses to a
-  // uniform 404 not-found. The dispatcher already returns a uniform 403 for
-  // callers who lack the feature entirely.
-  const organizationReadDenied = denyCustomerDetailReadAsNotFound(
-    { scope, auth, organizationId: deal.organizationId },
-    'Deal not found',
-  )
-  if (organizationReadDenied) return organizationReadDenied
+  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {
+    return forbidden('Access denied')
+  }
 
   const decryptionScope = {
     tenantId: deal.tenantId ?? auth.tenantId ?? null,
@@ -966,8 +977,8 @@ export const openApi: OpenApiRouteDoc = {
       ],
       errors: [
         { status: 401, description: 'Unauthorized', schema: dealDetailErrorSchema },
-        { status: 403, description: 'Forbidden — caller lacks the required feature', schema: dealDetailErrorSchema },
-        { status: 404, description: 'Deal not found, or its organization is not in the caller’s scope', schema: dealDetailErrorSchema },
+        { status: 403, description: 'Forbidden for tenant/organization scope', schema: dealDetailErrorSchema },
+        { status: 404, description: 'Deal not found', schema: dealDetailErrorSchema },
       ],
     },
   },

package/src/modules/customers/api/deals/[id]/stats/route.ts

@@ -7,6 +7,7 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { CustomerDeal, CustomerPipeline } from '../../../../data/entities'
 import { DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
@@ -23,6 +24,10 @@ function notFound(message: string) {
   return NextResponse.json({ error: message }, { status: 404 })
 }
 
+function forbidden(message: string) {
+  return NextResponse.json({ error: message }, { status: 403 })
+}
+
 function badRequest(message: string, code?: string) {
   return NextResponse.json(
     code ? { error: message, code } : { error: message },
@@ -62,10 +67,23 @@ export async function GET(request: Request, context: { params?: Record<string, u
     return NextResponse.json({ error: translate('customers.errors.authentication_required', 'Authentication required') }, { status: 401 })
   }
 
-  // The API dispatcher already enforces `requireFeatures: ['customers.deals.view']`
-  // against the caller's effective (selected) organization before this handler
-  // runs, so no in-route feature re-check is needed. Re-checking against the token
-  // org (auth.orgId) would wrongly 403 org-switched callers (#5012).
+  let rbac: RbacService | null = null
+  try {
+    rbac = (container.resolve('rbacService') as RbacService)
+  } catch {
+    rbac = null
+  }
+
+  if (!rbac || !auth?.sub) {
+    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
+  }
+  const hasFeature = await rbac.userHasAllFeatures(auth.sub, ['customers.deals.view'], {
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+  })
+  if (!hasFeature) {
+    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
+  }
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
   const em = (container.resolve('em') as EntityManager)
@@ -80,11 +98,8 @@ export async function GET(request: Request, context: { params?: Record<string, u
     return notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
   }
 
-  // Existence oracle (#5504): deny a cross-org read as not-found — identical to
-  // the deal-not-found above — so it cannot reveal that a deal exists in an
-  // organization the caller cannot see.
   if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {
-    return notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
+    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
   }
 
   if (!deal.closureOutcome) {
@@ -191,8 +206,8 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Deal is not closed', schema: dealStatsErrorSchema },
         { status: 401, description: 'Unauthorized', schema: dealStatsErrorSchema },
-        { status: 403, description: 'Forbidden — caller lacks the required feature', schema: dealStatsErrorSchema },
-        { status: 404, description: 'Deal not found, or its organization is not in the caller’s scope', schema: dealStatsErrorSchema },
+        { status: 403, description: 'Forbidden for tenant/organization scope', schema: dealStatsErrorSchema },
+        { status: 404, description: 'Deal not found', schema: dealStatsErrorSchema },
       ],
     },
   },

package/src/modules/customers/api/deals/aggregate/route.ts

@@ -14,7 +14,6 @@ import type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { fetchStuckDealIds } from '../../../lib/stuckDeals'
-import { expandDealStatusAliases } from '../../../lib/dealStatus'
 import { findMatchingEntityIdsBySearchTokensAcrossSources } from '../../utils'
 import { E } from '#generated/entities.ids.generated'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -28,7 +27,7 @@ export const metadata = {
 const querySchema = z.object({
   pipelineId: z.string().uuid().optional(),
   search: z.string().optional(),
-  status: z.array(z.string().max(50)).max(20).optional(),
+  status: z.array(z.enum(['open', 'closed', 'win', 'loose'])).optional(),
   ownerUserId: z.array(z.string().uuid()).optional(),
   personId: z.array(z.string().uuid()).optional(),
   companyId: z.array(z.string().uuid()).optional(),
@@ -248,11 +247,9 @@ export async function GET(req: Request) {
     }
   }
   if (parsed.data.status && parsed.data.status.length) {
-    // Non-empty input always expands to a non-empty set, so this always narrows.
-    const expandedStatuses = expandDealStatusAliases(parsed.data.status)
-    const placeholders = expandedStatuses.map(() => '?').join(',')
+    const placeholders = parsed.data.status.map(() => '?').join(',')
     where.push(`status IN (${placeholders})`)
-    values.push(...expandedStatuses)
+    values.push(...parsed.data.status)
   }
   if (parsed.data.ownerUserId && parsed.data.ownerUserId.length) {
     const placeholders = parsed.data.ownerUserId.map(() => '?').join(',')
@@ -268,14 +265,7 @@ export async function GET(req: Request) {
     values.push(parsed.data.expectedCloseAtTo)
   }
   if (parsed.data.isOverdue) {
-    // Mirror the list route's precedence: the caller-supplied status filter wins, and
-    // status='open' is injected only when none was provided.
-    const hasCallerStatus = !!parsed.data.status?.length
-    if (hasCallerStatus) {
-      where.push('expected_close_at < CURRENT_DATE')
-    } else {
-      where.push("expected_close_at < CURRENT_DATE AND status = 'open'")
-    }
+    where.push("expected_close_at < CURRENT_DATE AND status = 'open'")
   }
   if (parsed.data.isStuck) {
     // Reuse the list endpoint's stuck-deal lookup so kanban headers, lane counts, and the

package/src/modules/customers/api/deals/map/route.ts

@@ -545,6 +545,5 @@ export async function GET(req: Request) {
     page: query.page,
     pageSize: query.pageSize,
     totalPages: Math.ceil(res.total / (query.pageSize || 1)),
-    ...(res.meta?.listCountCapWarning ? { totalIsCapped: true } : {}),
   })
 }

package/src/modules/customers/api/deals/route.ts

@@ -22,9 +22,7 @@ import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { consumeAdvancedFilterState, mergeAdvancedFilterTree } from '@open-mercato/shared/lib/crud/advanced-filter-integration'
-import type { FilterGroup, FilterRule } from '@open-mercato/shared/lib/query/advanced-filter-tree'
 import { fetchStuckDealIds } from '../../lib/stuckDeals'
-import { expandDealStatusAliases } from '../../lib/dealStatus'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('customers')
@@ -33,19 +31,6 @@ const rawBodySchema = z.object({}).passthrough()
 
 const stringOrStringArray = z.union([z.string(), z.array(z.string())])
 const OPEN_DEAL_STATUSES = ['open', 'in_progress'] as const
-// Tree operators whose `status` values are rewritten through the canonical vocabulary.
-// Text (`contains`/`starts_with`/…) and range (`between`) operators are left untouched
-// so a URL-supplied rule keeps its scalar semantics.
-const STATUS_TREE_OPERATORS = new Set([
-  'is',
-  'equals',
-  'is_not',
-  'not_equals',
-  'is_any_of',
-  'has_any_of',
-  'is_none_of',
-  'has_none_of',
-])
 const booleanQueryParam = z.preprocess((value) => {
   const parsed = parseBooleanFromUnknown(value)
   return parsed === null ? value : parsed
@@ -260,39 +245,6 @@ function normalizeUuidList(values: Array<unknown>): string[] {
 
 export async function buildDealListFilters(query: DealListQuery, ctx?: import('@open-mercato/shared/lib/crud/factory').CrudCtx) {
   const advancedFilterTree = consumeAdvancedFilterState(query)
-  if (advancedFilterTree) {
-    // Expand status aliases in the advanced-filter tree so List (tree path) and
-    // Kanban (plain ?status=) share the same canonical vocabulary (#5107). Only
-    // set-membership operators are rewritten — text/range operators on `status`
-    // keep their pre-existing scalar semantics instead of being corrupted.
-    const walk = (node: FilterGroup | FilterRule): void => {
-      if (node.type === 'rule' && node.field === 'status' && STATUS_TREE_OPERATORS.has(node.operator)) {
-        const listOperators = new Set(['is_any_of', 'has_any_of', 'is_none_of', 'has_none_of'])
-        const rawValues: string[] = Array.isArray(node.value)
-          ? (node.value as unknown[]).filter((v): v is string => typeof v === 'string')
-          : typeof node.value === 'string'
-            ? [node.value]
-            : []
-        if (rawValues.length === 0) return
-        const expanded = expandDealStatusAliases(rawValues)
-        if (listOperators.has(node.operator)) {
-          node.value = expanded
-        } else if (expanded.length === 1) {
-          node.value = expanded[0]
-        } else {
-          node.value = expanded
-          if (node.operator === 'is' || node.operator === 'equals') {
-            node.operator = 'is_any_of'
-          } else if (node.operator === 'is_not' || node.operator === 'not_equals') {
-            node.operator = 'is_none_of'
-          }
-        }
-      } else if (node.type === 'group') {
-        for (const child of node.children) walk(child)
-      }
-    }
-    walk(advancedFilterTree.root)
-  }
   const filters: Record<string, unknown> = {}
   let restrictedIds: string[] | null = null
 
@@ -348,8 +300,7 @@ export async function buildDealListFilters(query: DealListQuery, ctx?: import('@
     }
   }
 
-  const rawStatusList = query.status ? normalizeStringList(query.status) : []
-  const statusList = expandDealStatusAliases(rawStatusList)
+  const statusList = query.status ? normalizeStringList(query.status) : []
   if (statusList.length > 0) {
     filters.status = statusList.length === 1 ? { $eq: statusList[0] } : { $in: statusList }
   }

package/src/modules/customers/api/entity-roles-factory.ts

@@ -77,14 +77,10 @@ function ensureRouteOrganizationAccess(
   organizationId: string,
   scope: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['scope'],
   auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],
-  notFoundMessage: string,
+  translate: Translator,
 ) {
-  // Existence oracle (#5504): a caller who holds the feature but whose scope
-  // excludes the record's organization is denied as not-found (the same response
-  // the caller gets for a missing record), so this cannot reveal that the record
-  // exists in an organization they cannot see.
   if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {
-    throw notFound(notFoundMessage)
+    throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
   }
 }
 
@@ -136,7 +132,7 @@ async function resolveEntityRouteScope(
   if (!entity || entity.tenantId !== auth.tenantId) {
     throw notFound(translate('customers.errors.customer_not_found', 'Customer not found'))
   }
-  ensureRouteOrganizationAccess(entity.organizationId, scope, auth, translate('customers.errors.customer_not_found', 'Customer not found'))
+  ensureRouteOrganizationAccess(entity.organizationId, scope, auth, translate)
   return {
     entity,
     organizationId: entity.organizationId,
@@ -168,7 +164,7 @@ async function resolveRoleRouteScope(
   ) {
     throw notFound(translate('customers.errors.role_not_found', 'Role not found'))
   }
-  ensureRouteOrganizationAccess(role.organizationId, scope, auth, translate('customers.errors.role_not_found', 'Role not found'))
+  ensureRouteOrganizationAccess(role.organizationId, scope, auth, translate)
   return {
     role,
     organizationId: role.organizationId,

package/src/modules/customers/api/interactions/route.ts

@@ -180,7 +180,7 @@ type InteractionListRow = {
   all_day: boolean | null
   recurrence_rule: string | null
   recurrence_end: Date | null
-  participants: Array<{ userId?: string; name?: string; email?: string; status?: string }> | null
+  participants: Array<{ userId: string; name?: string; email?: string; status?: string }> | null
   reminder_minutes: number | null
   visibility: string | null
   linked_entities: Array<{ id: string; type: string; label: string }> | null
@@ -744,13 +744,7 @@ const interactionListItemSchema = z
     recurrenceEnd: z.string().nullable().optional(),
     participants: z.array(
       z.object({
-        userId: z
-          .string()
-          .uuid()
-          .optional()
-          .describe(
-            'Absent for an external guest, who has no person/customer/staff record and is identified by email instead. Identify a participant by userId when present, otherwise by its normalized email.',
-          ),
+        userId: z.string().uuid(),
         name: z.string().optional(),
         email: z.string().optional(),
         status: z.string().optional(),